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SECRET 


MEMORANDUM FOR: Executive Director-Comptroller 


SUBJECT : Allocation of Resources to the 
Computer Security Program, 
Office of Security 


1. This memorandum suggests action on your part; this 
action is contained in paragraph 11. 


2. The report of the Inspector General's survey of the 
Office of Computer Services contained the following Recommenda- 
tion No. 9: 


"That OCS and OS review their ADP security 
manpower requirements and develop measures to 
insure the secure, compartmented use of the OCS 
time-sharing 360/67 system both for CIA internal 
needs and for potential COINS application. "' 


3. Security manpower has been assigned to computer 
security tasks since the inception of the program in the Agency. 
On 30 July 1967, a Special Assistant to the Director of Security was 
designated for computer security. He has served continuously in 
this assignment with enthusiasm and has received a graduate 
certificate from the American University in the field of Management 
Information Systems. He has become a recognized expert in com- 
puter security not only within the Agency but also in the intelligence 
community. Since 24 May 1968, he has served as Chairman of the 
Computer Security Working Group, later the Computer Sub-Committee 
of the Security Committee of USIB. He is also a consultant to the 
DIA for the proposed security testing of the Analyst Support and 
Research System (ANSRS). 
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4, As a result of continuing review and analysis of its 
computer security responsibilities, the Office of Security deter~- 
mined that it would be necessary to assign two additional positions 
and funds in the amount of $60, 000 to be used for contracting with 
industrial specialists to implement a program of testing and 
evaluating computer equipment from a security standpoint. The 
positions and funds were requested for FY 1970 in the FY 1970- 
1974 Program Call submitted by the Office of Security. These 
positions could not be allocated to that Office and the overall 
reduction made in the Office of Security budget estimates pre- 
cluded the hiring of industrial specialists on a contract basis. 

Even though additional positions were not allocated to the Office 

of Security, it was determined that this program should be initiated 
as soon as possible. In order to accomplish this, two additional 
Security Officers (GS-13 and GS-12) were detailed to work full time 
on computer security tasks, One was as signed in June 1968; the 
other, in July 1969. 


5, In mid-1969, it was determined that the computer 
security functions and responsibilities warranted formal recogni- 
tion as an organizational element under the Chief, Executive Staff. 
Therefore, on 16 October 1969, the Information Processing Branch 
was formally established. Positions for this new Branch were 
obtained by internal reallocations within the Office of Security as 
follows: 


1 GS-13/14 -- Security Officer (Chief) 
1 GS-13 -- Security Officer 

1 GS-12 -- Security Officer 

1 GS-06 -- Secretary 


6. The GS-12 position was eliminated as of 30 June 1970 
due to a reduction in the Office of Security ceiling for FY 1971. 
The GS-12 incumbent, however, is still assigned to the Branch on 
an overstrength basis because of the continuing heavy workload. 
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7. Funds for the contract hire of industrial specialists 

for FY 1971 in the amount of $62,000 were included in the 

FY 1971-1975 Program Call for the Office of Security submitted 
in February 1969. In submitting the FY 1972-1976 Program Call 
for the Office of Security in February 1970, the amount for con- 
tract hire of industrial specialists was reduced to $40, 000 due to 
budget limitations for FY 1971. In view of the five percent hold- 
back in the temporary fund authorization for the Office of Security 
for FY 1971, this amount was further reduced to $28, 000. 


8. Based on a recent review of the present and proposed 
computer security program with the Director of Security and the 
Acting Director of Computer Services, it was determined that 
increased emphasis should be placed on both the staff and opera- 
tional assets of this program, Further, the Office of Security has 
determined that the computer security responsibilities should be 
transferred from the Executive Staff to its Physical Security 
Division. Also, that in order to give the individual in charge 
proper recognition and authority consistent with his duties and 
responsibilities, he should be designated as the Deputy Chief, 
Physical Security Division for Computer Security. 


9. We are convinced that in order to develop a fully 
responsive security program for the long haul, it will be necessary 
for a professionally trained system programmer to be a part of the 
Security team. Additionally, an engineer, competent in hardware 
design, structure and logic, will be required to round out the pro- 
gram. This need has been studied in conjunction with the Office of 
Computer Services for some time and has the complete concurrence 
of the Acting Director of that Office. 


10, We consider the Director of Security to be responsible 
for: 


a. Developing and publishing uniform security 
policy and standards for maintaining the security 
of Agency computer and related information 
processing operations; 
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Directing a coordinated Agency program 
toward the identification and resolution of 
security problems involved in the use of 
computers and other modern techniques in 
the processing of official data; 


Providing Agency computer components and 
users guidance in the handling of security 
problems posed by such operations; 

Conducting security audits of Agency computer 
systems used for the processing of official data 
in order to insure uniform application of com- 
puter security policy and to test and evaluate 
systems as to their security merit; and 
Providing Agency support to computer security 
efforts within the USIB community where the 
Agency has an assigned responsibility or where 


it is requested to provide assistance, 


ll, The proposed Table of Organization for the revised 
is as follows: 


1 GS-14: -- Security Officer (Deputy Chief, Physical 
Security Division for Computer Security) 


GS-13/14 Security Officer (Chief, Computer 
Security Branch) 


Security Officer 

System Programmer (contract) 
Security Officer 

Engineer 


Secretary 


4 
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All of the positions will be provided from the existing ceiling and 
Table of Organization of the Office of Security. The Director of 
‘Security will transfer a GS-14 slot from the Special Security 
Center. He will attempt to fill the System Programmer (GS-13) 
position on a contract basis. The GS-12 Engineer position will 
be transferred from the Technical Division, Office of Security. 
Subject to your approval of this plan, we will proceed with the 
necessary organizational formalities. 


12. In order to fund the contract position and to provide 
additional funds for external contractual efforts, these items will 
be included as additional Office of Security funding requirements 
when the Support Directorate's budget for FY 1971 is being 
finalized. The amounts include $20, 000 for a GS-13 level System 
Programmer and $22, 000 to be used to contract for a program of 
testing and evaluating computer equipment from a security stand- 
point, or a total of $42, 000. 


R. L. Bannerman 
Deputy Director 
for Support 
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SUBJECT: Allocation of Resources to the Computer 
Security Program, Office of Security 


CONCURRENCE: 


Acting Director : Computer i pees 


The action contained in paragraph 11 is approved. 


L. K. White 
Executive Director ~-Comptroller 


Distribution: 

Orig - Return to OS via DD/S 
1 - Ex, Dir. -Compt. 
1-ER 
2 - DD/S 
1 - Acting D/OCS 
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